CVE-2026-114663: Vyper name resolution scope vulnerability in constants and defaults

CVE-2026-114663 · Severity: high · CVSS 8.4 · Published 2026-10-22

Vyper is a smart contract programming language for Ethereum. A compilation defect causes function variables to shadow imported module constants and default arguments, allowing attackers to inject unintended values—including values outside declared type ranges—into validation and accounting logic. Exploitable only when a contract parameter, local, or loop variable shares a name with a module constant or default argument, and user input influences that variable.

Technologies: Vyper. Vendors: Vyper.

Quick answers

Is CVE-2026-114663 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114663 being exploited in the wild.
How severe is CVE-2026-114663?
High severity, with a CVSS score of 8.4, published 22 October 2026.
Which products and versions are affected?
Vyper 0.4.0b1 through 0.5.0b1.
Is there a fix for CVE-2026-114663?
No fixed version is recorded yet. Use fully folded (compile-time-constant) literal values instead of unfoldable constants for defaults; avoid naming collisions between parameters, locals, or loop variables and imported constant or default names throughout the expanded expressions; explicitly pass a qualified immutable reference instead of relying on defaults. Deployed contracts may require recompilation and redeployment.</anigation> <parameter name="timeline">[{"kind": "advisory", "at": "2026-10-07", "note": "GitHub Security Advisory GHSA-2489-32vh-8rrc published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-114663 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-114663?
Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Use fully folded (compile-time-constant) literal values instead of unfoldable constants for defaults; avoid naming collisions between parameters, locals, or loop variables and imported constant or default names throughout the expanded expressions; explicitly pass a qualified immutable reference instead of relying on defaults. Deployed contracts may require recompilation and redeployment.</anigation> <parameter name="timeline">[{"kind": "advisory", "at": "2026-10-07", "note": "GitHub Security Advisory GHSA-2489-32vh-8rrc published"}]

Technical details

The parse_Name function in vyper/codegen/expr.py resolves names against the using function's local scope (context.vars) instead of their declaration site, affecting unfoldable constants and omitted default arguments from imported modules. When a same-named parameter, local, or loop variable exists in the function, it replaces the intended module binding during compilation. Type constraints are bypassed because primitive setters trust internally encoded values without clamping to the destination type, permitting uint256 values to enter nominal uint8 slots unchanged.

Affected products

  • Vyper Vyper 0.4.0b1 through 0.5.0b1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.